[P1] Add End-To-End API Workflow Tests With Sample Extensions

[barvhaim]

Roadmap Item 9: Add End-To-End API Workflow Tests With Sample Extensions

Priority: P1
Area: Testing
References: tests/, src/threatxtension/api/main.py

Current tests cover selected regressions, but there is no fixture-based scan covering
the full upload/trigger/status/results path with deterministic analyzer behavior.

Scope:

• Add small safe and malicious sample extensions under test fixtures.
• Mock network-backed analyzers and LLM calls.
• Exercise upload scan, URL/id scan, status polling, results loading, file listing, and
  file content retrieval.

Acceptance criteria:

• uv run pytest covers core API scan lifecycle without external credentials.
• Tests assert score, finding count, status transitions, and file viewer behavior.
• CI can run tests without Semgrep network access or LLM API keys.

---

Created from docs/roadmap.md.